Vulnerability - CVE-2026-76217

›

›vulnerability›CVE-2026-76217

Name

CVE-2026-76217

Source

NVD ( link)Debian ( link)

Description

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

CWEs

Published Date

Aug 19, 2026

Updated Date

Sep 3, 2026

Workaround

-

Advisories

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfcExploit

https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-fileThird Party Advisory

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfcExploit

Analysis#

Affected Component

Analysis

Vulnerability Ratings#

7.1

CVSSv4

6.5

CVSSv31

NaN

other

Others affected component#

Name

Project

Project Version

Version

Status

yocto

master

3.2.0

Not Affected